Evan Schuman's StorefrontBacktalk

When a gang of thieves physically tampers with point-of-sale systems, the tampering is usually a local operation. But that may be changing. Discount grocer Aldi said Friday (Oct. 1) that it has found tampered payment-card readers in stores in 11 states, spread from the east coast to Illinois. The retailer said the tampering was only in a limited number of its 1,100 U.S. stores, and all those stores were clustered near 10 cities—but the stolen data is being cashed out thousands of miles away.

That’s reason to worry. Physical tampering with PIN pads is typically local because it’s labor intensive. Thieves have to physically modify or replace the card terminals, which is why hacked terminals are usually found in a local cluster. This time there are clusters, all right—10 of them, stretching from Illinois to Georgia. Meanwhile, part of what made this $70 billion global grocery chain so successful—both in terms of European shoppers and fiscal profitability—could be playing a key role in making it a cyberthief target today: The scarcity of store employees.

The 10 areas hit with tampering were Chicago; Indianapolis; Pittsburgh; Philadelphia (including stores in New Jersey); Atlanta; Washington, D.C. (including stores in Virginia and Maryland); Rochester, N.Y.; Hartford, Conn.; Raleigh, N.C; and Charlotte. N.C. The retailer won’t say exactly how many stores got the tampered devices, but a spokesperson said that they were found in only a “limited number” of stores, and they were probably placed there during June, July and August.

By September, the thieves started using the stolen data. Customers of a single suburban Chicago Aldi store reported $130,000 in fraudulent ATM withdrawals using their debit card information, according to the Chicago Tribune. Local police said most of the ATM withdrawals were made in southern California, in amounts ranging from $100 to $900, although some withdrawals were also made at ATMs in Ohio and in the Chicago area.

Aldi said that the chain has examined card readers at every U.S. store, removed suspect readers and tightened security.

It’s not hard to guess why Aldi was targeted. “Have you even been in an Aldi store? There are almost no employees,” said payment systems specialist Andy Orrock, COO of On-Line Strategies.

The chain’s stores, which are all in the eastern half of the U.S., are the very definition of “no frills,” and staffing is minimal. That makes it much easier for a thief to steal a PIN pad from an unattended checkout lane, or to swap in a PIN pad that’s been outfitted with a skimmer, Orrock said.

And because Aldi only accepts debit cards, not credit cards, at most stores, the card information collected by a skimmer (complete with PIN) would give direct access to a customer’s bank account.